Cloudflare. It's been a real life saver for us.
Ask HN: How do you handle DDoS attacks?
11–20 of 114 posts
Re: Ask HN: How do you handle DDoS attacks?
#12I use and recommend hosting with OVH if you are worried about DDOS and serving a Western market. No affiliation, just a happy customer. OVH include DDOS protection by default[0] and they have a very robust backbone network[1] in Europe and North America that they own and operate themselves (this is how & why anti-DDOS is standard with them). For quick side-projects I still fire up a DigitalOcean instance or two becau…
Tangential, but how do you find OVH? Their hardware, bandwidth, uptime, customer service? I ask because of the conflicting reviews of OVH that a quick google search reveals.
Re: Ask HN: How do you handle DDoS attacks?
#13Cloudflare. It's been a real life saver for us.
Could you elaborate? Which plan are you on? What was the size of the DDoS attack?
Re: Ask HN: How do you handle DDoS attacks?
#14Don't piss anyone off
That is excellent advice, in combination with other tactics.
If you do piss anyone off, keep records of everything. Make sure you know who they are, and where they live, before you start doing business with them. This lets you send the police after they hire someone to DDoS you. Bad people need to be removed from the pool to reduce these sorts of attacks. Record 100% of your phone calls. Android has free apps to do this for you automatically. If you're in a state that requires 2-party authorization, move to a state that offers 1-party authorization. Sanity in laws = freedom of citizens.
Re: Ask HN: How do you handle DDoS attacks?
#15Earlier quoted context omitted.
Source?
https://www.cloudflare.com/plans/ Look at the "Advanced security" section. I also used Siege to flood a site behind Cloudflare's free plan and brought it down.
That page argues against your point, even the basic plan does quite a bit to fend of DDOS. In particular, the most common and effective type of DDOS, which is volumetric and based on reflected UDP traffic, is defended against, even on their free tier.
Using a tool like Siege to bring a site behind Cloudflare down doesn't mean it's not protected. A layer 7 attack against a site which can't handle incoming HTTP requests is still possible. Cloudflare, or any other service, can't magically make a site scale.
Re: Ask HN: How do you handle DDoS attacks?
#16A) have enough servers so when one gets null routed, it's not a huge deal
B) make sure your servers don't fall over while getting full line rate of garbage incoming (this is not hard for reflection or synfloods, but is difficult if they're hitting real webpages, and very difficult if it includes a tls handshake)
C) bored ddos kiddies tend to ddos www only, so put your important things on other sub domains
D) hope you don't attract a dedicated attacker
Re: Ask HN: How do you handle DDoS attacks?
#17Earlier quoted context omitted.
Source?
https://www.cloudflare.com/plans/ Look at the "Advanced security" section. I also used Siege to flood a site behind Cloudflare's free plan and brought it down.
There's the option for free plans: Basic DDOS protection with the following blurb:
Built-in security measures automatically protect your website against DDoS attacks. CloudFlare's service allows your legitimate traffic to reach your website, while stopping illegitimate traffic at the edge, before it hits your server.
So Cloudflare promises least a minimal protection for free plans.
As for Siege, I assume Cloudflare is optimized to protect from botnets. A single machine running Siege is not a realistic test case. Perhaps it also depends whether your website is mostly static, then Cloudflare can do a lot of caching.
Re: Ask HN: How do you handle DDoS attacks?
#18Cloudbric offers free DDoS protection. https://cloudbric.com
They don't have any cdn in China, so it doesn't work for this market.
Re: Ask HN: How do you handle DDoS attacks?
#19I use and recommend hosting with OVH if you are worried about DDOS and serving a Western market. No affiliation, just a happy customer. OVH include DDOS protection by default[0] and they have a very robust backbone network[1] in Europe and North America that they own and operate themselves (this is how & why anti-DDOS is standard with them). For quick side-projects I still fire up a DigitalOcean instance or two becau…
Have you been DDoSed while on OVH? I've heard there are a bunch of providers who claim DDoS prevention, but what that means in practice is just "we'll take your site offline right away and not charge you for the incoming bandwidth!". Super helpful.
Re: Ask HN: How do you handle DDoS attacks?
#20I use and recommend hosting with OVH if you are worried about DDOS and serving a Western market. No affiliation, just a happy customer. OVH include DDOS protection by default[0] and they have a very robust backbone network[1] in Europe and North America that they own and operate themselves (this is how & why anti-DDOS is standard with them). For quick side-projects I still fire up a DigitalOcean instance or two becau…
As a word of caution for OVH their anti-ddos protection can be a little too strict at times. The nature of traffic on our site is such that we often get big spikes of traffic via social media. We were testing out OVH earlier this month to see if offloading part of our site to their servers would work well and they ended up shutting our vps server down for an hour when we got a big spike. After working with their support team they did say if we purchased a dedicated server they would possibly be able to set up a rule to account for this, but their vps at least couldn't be fixed. For what it's worth before they blocked the traffic the vps was handling the traffic just fine. So if you're thinking of getting a dedicated server you may be okay, but just use caution if you expect any sort of spike in traffic as OVH's algorithms may block it as a DDoS even though you are sure its legitimate. Edit: Also again, to be clear, they blocked 100% of the traffic when the "attack" happened. Their solution wasn't to block the "attack" but to just null route the ip.